Virgin Media could face a data breach probe after a job hunter uploaded his CV to the cable firm's graduate recruitment site and discovered he had access to as many as 50,000 past and present CVs from fellow applicants.

Further Reading

The Information Commissioner's Office told Ars on Tuesday morning that it was looking at the sizeable data gaffe.

Student Alikhan Uzakov reported the flaw to Virgin Media, which subsequently plugged the hole in the site. Uzakov then went public with his findings a couple of days ago. He wrote:

Whilst I was filling out an application form for Virgin Media, I was offered the option to see my uploaded CV. What happened was quite surprising, the URL revealed a directory (folder) where my CV was stored.

When I opened the directory I was able to see all past and present applications. This was a broken access control. In layman terms this means that access to certain data was allowed without authorisation.

According to Uzakov, "about 30,000–50,000 applications, past and present, were accessible," and personal information that included phone numbers, e-mails, and home addresses "were out there in the open." He said he had originally attempted to report the issue via Twitter, but received no response until he put a call into Virgin Media's London office a day later.

A spokesperson for Virgin Media—who didn't quibble with the 50,000 CVs figure—told Ars that applications for its graduate scheme had been managed by an unnamed third party, confirmed that the botch-job had now been fixed, and that it had reported the matter to the ICO. The company said:

Virgin Media works with a third party that provides an online application service for graduates wishing to apply for Virgin Media jobs.

After a vulnerability on the third party company’s website was identified, the website was suspended while the issue was fixed. The service has now resumed. Virgin Media’s systems were not affected in any way.

Further Reading

Campus Futures currently manages VM's graduate recruitment programme. The outfit says it collects information on behalf of the telco, but it doesn't provide any link to its privacy policy to confirm compliance with data protection law when an applicant initially uploads their CV via the site. Ars has sought comment from Campus Futures and will update this story if it responds to our questions.

An ICO spokesperson told Ars that it was examining whether Virgin Media may have broken the Data Protection Act, saying:

The law requires organisations to keep any personal information they hold secure. We are aware of an incident involving Virgin Media and personal data from CVs being publicly available online. We are looking into the details.

Uzakov said that while Virgin Media did thank him for spotting the flaw, he wouldn't be officially recognised for his findings, or be given preference over other applicants to the grad scheme "since it’s unfair."